Protocol reverse engineering system based on reinforcement learning and working method thereof

Abstract

The invention provides a protocol reverse engineering system based on reinforcement learning and a working method thereof. The protocol reverse engineering system comprises a decoding environment module and a decoding intelligent agent module, wherein the decoding environment module receives the state of the previous moment and the current action output by the decoding intelligent agent module, and inputs a new state to the decoding intelligent agent module. Compared with the prior art, the method has the advantages that the protocol structure tree is used for representing the protocol structure, and the method is high in expression capacity, rich in semantics and capable of supporting a complex structure; and 2) a protocol reverse engineering method based on deep reinforcement learning isinnovatively provided, after a large amount of data is trained, the application range is wide, and reverse engineering can be carried out on data of different types of protocols. And 3) when the trained decoding model executes protocol reversing, any priori knowledge is not needed, manual participation is not needed, and protocol reversing can be executed in a full-automatic manner.

Description

technical field [0001] The invention relates to protocol reverse engineering, in particular to a protocol reverse engineering system and working method based on reinforcement learning. Background technique [0002] A protocol is a series of rules, standards, and conventions established for network data exchange, and is the core of computer networks and data communications. [0003] For an open protocol, such as Hyper Text Transfer Protocol (HTTP, Hyper Text Transfer Protocol), its detailed description information can be obtained from public documents (such as RFCs). [0004] But for private protocols, the protocol description information is usually not made public. [0005] Protocol reverse engineering refers to the process of obtaining application-level description information of unknown protocols. [0006] The traditional method of protocol reverse engineering is manual, which is very labor-intensive and error-prone. A typical example is the SAMBA project. The SAMBA pr...

AI Technical Summary

Problems solved by technology

[0015] 2) The invention can only find the positions of some fields with semantic features, and cannot obtain the complete protocol message format;

[0019] 1) It is only segmented, and complete information such as the encoding method of each field is not deduced;

[0020] 2) Does not support complex nested structures;

[0026] Existing technologies have defects such as requiring additional prior knowledge, supporting few types of protocols, not being able to recognize protocols with complex structures, and inferring protocol specifications that are incomplete and unclear.

Images